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1   INTRODUCTION 

The  ARC  system  is  a  damage  tolerant  information  network  designed 
for  shipboard  communication.  Modern  military  ships  have  an  abundance  of 
control  systems.  These  control  systems  can  include  several  transducers, 
controllers,  actuators,  and  displays.  The  control  systems  are  intercon- 
nected in  a  hierarchy  on  the  basis  of  their  function  and  importance.  Com- 
munications among  the  devices  within  a  control  system  and  among  different 
control  systems  are  transmitted  over  communication  networks  that  are  ar- 
ranged in  a  hierarchy  matching  that  of  the  control  systems.  Associated 
with  each  device  in  the  control  system  is  a  node  of  the  local  subsystem  of 
the  communication  network.  It  is  at  these  nodes  that  information  passes 
into  and  out  of  the  communication  network.  The  actual  hardware  that  im- 
plements a  node  will  be  referred  to  as  a  station.  In  combat  situations, 
it  is  likely  that  the  ship  will  sustain  damage.  It  is  of  great  importance 
that  the  communication  network  linking  the  control  systems  still  function 
when  a  number  of  stations  have  been  destroyed  by  explosions  or  shrapnel. 
The  network  should  automatically  reconfigure  itself  so  that,  if  possible, 
all  of  the  surviving  nodes  are   connected. 

This  thesis  describes  a  loop  communication  network  that  can  be 
used  to  link  control  systems  and  devices  within  control  systems.  The 
hierarchy  can  be  formed  from  single  loop  systems  as  described  by  Pierce.6 
A  major  difference  between  ARC  and  other  communication  networks  is  in  how 
it  recovers  and  reconfigures  itself  when  communication  lines  are  severed 
and/or  random  nodes  in  the  network  are  destroyed.  Most  know  systems2'3'14'6'9 


use  software  tests  to  detect  damage  and  deduce  the  needed  changes.  Most 
nonloop  networks  use  alternate  "central  network  controllers"  which  take 
over  if  the  main  network  controller  is  damaged.  This  arrangement  requires 
that  each  station  be  attached  to  at  least  two  central  controllers  if  one 
hit  is  to  be  survived.  The  ARC  system,  as  proposed  by  Poppelbaum,7  is  a 
double  loop  network  with  completely  distributed  control.  It  uses  simple 
hardware  tests  to  detect  damage  and  to  achieve  the  best  reconfiguration. 
Section  2  discusses  some  theoretical  considerations  involved  in 
specifying  communication  networks  in  general  and  loop  communication  net- 
works in  particular.  The  ARC  system  design  and  implementation  is  described 
in  Section  3.  Conclusions  are  made  in  Section  4. 
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2  THEORETICAL  CONSIDERATIONS 

This  section  addresses  some  of  the  design  parameters  and  problems 
involved  in  communication  networks.  Each  subsection  first  discusses  com- 
munication networks  in  general,  then  treats  the  special  case  of  loop  sys- 
tems. 

2.1  Frame  Format 

To  allow  uniform  handling  of  messages,  they  are  usually  broken 
into  blocks  of  uniform  length  for  transmission.  Certain  bit  positions  in 
the  blocks  are  reserved  for  addressing  and  other  network  supervisory  func- 
tions. In  the  ARPA  network1  and  other  nonloop  networks,  data  lines  are 
kept  in  an  idle  state  when  no  message  is  being  sent.  One  or  more  start 
bits  are  used  to  initiate  a  transfer.  In  most  loop  systems,3'6'7'9  mes- 
sages are  multiplexed  into  time  slots  called  frames.  The  duration  of  a 
frame  is  an  integral  fraction  of  the  total  time  delay  of  the  loop.  A  fixed 
number  of  frames  circulate  around  the  loop  at  all  times.  Hence,  the  frame 
format  must  include  information  on  whether  a  frame  is  currently  in  use  or 
not. 

Typically,  in  each  frame,  the  network  control  fields  include  bit 
positions  for  clock  synchronization  and  a  number  of  bits  to  specify  the 
state  of  the  frame  (busy,  idle,  undeli verable,  etc.).  Fields  for  a  desti- 
nation address  and  a  source  address  are  needed.  Sometimes  error  detection 
or  correction  fields  are  also  included. 


The  length  of  the  frame  is  a  function  of  the  average  size  of  the 
messages  that  are  to  be  transmitted.  If  messages  are  long,  short  frames 
are  inefficient  because  the  constant  number  of  network  control  bits  that 
must  be  included  in  each  frame  greatly  increase  the  total  number  of  bits 
that  must  be  sent.  On  the  other  hand,  if  messages  are   short,  long  frames 
are  inefficient  because  the  unused  bits  in  the  information  field  of  the 
frames  must  still  be  sent.  Another  factor  favoring  short  frame  lengths 
arises  if  the  network  depends  on  a  handshake  type  acknowledgment  of  each 
message  block  sent.  In  this  case,  a  second  complete  frame  must  be  used 
for  the  acknowledgment,  doubling  the  number  of  bits  that  must  be  sent.2 

2.2  Blocking 

If  one  or  more  stations  need  to  transmit  continuously  much  of 
the  time,  the  possibility  exists  that  the  network  may  become  saturated. 
Other  stations  attempting  to  send  messages  would  be  unable  to  find  an 
unused  frame  and  would  be  blocked  from  transmitting.  Several  techniques 
can  be  used  to  minimize  this  problem. 

If  the  offending  nodes  communicate  mainly  with  each  other,  they 
can  be  put  on  a  separate  trunk  or  loop  that  is  attached  to  the  main  network 
at  one  or  more  points.  This  will  allow  those  highly  active  terminals  to 
use  the  network  at  the  same  time  as,  and  without  blocking  the  other  ter- 
minals. 

In  situations  where  any  terminal  might  have  periods  of  high  ac- 
tivity, the  best  solution  is  to  choose  a  transmission  link  that  has  a 


data  rate  considerably  greater  than  the  average  transmission  rate  of  each 
terminal.  Thus,  it  is  insured  that  each  terminal  will  pass  at  least  one 
unused  (by  that  terminal)  frame  after  each  frame  used.6 

For  loop  systems  that  use  short  frames  (and  that  have  as  many 
storage  positions  in  their  stations  as  there  are  bits  in  their  frames), 
there  is  another  possible  solution.  When  a  station  waiting  to  transmit 
finds  the  last  n  frames  in  use,  it  is  given  the  capability  of  synchronously 
add  time  slots  one  frame  in  length  that  contain  the  data  it  wants  to  write 
onto  the  loop.  The  extra  time  slots  are  added  by  inserting  extra  shift 
register  buffers  into  the  transmission  path.  The  extra  time  slots  are 
added  on  the  downstream  side  of  the  station,  so  that  after  j  out  of  the 
previous  k  passing  frames  have  been  empty,  and  an  empty  frame  currently 
occupies  an  added  buffer,  the  buffer  can  be  bypassed  physically.  This  re- 
moves the  added  time  slot  from  the  loop.  This  scheme  would  allow  the  num- 
ber of  time  slots  in  the  loop  to  change  dynamically  as  a  function  of  the 
traffic  on  it.  As  the  number  of  time  slots  increases,  the  time  required 
for  each  frame  to  circulate  from  the  sender  to  the  receiver  also  increases. 
The  extra  time  is  manifest  as  a  delay  between  entry  to  and  exit  from  the 
loop.  The  amount  of  data  entering  and  leaving  the  loop  would,  however,  be 
increased.  The  optimal  number  of  frames  to  wait  before  entering  an  extra 
frame,  the  optimal  number  of  extra  time  slots  to  be  allowed  at  each  ter- 
minal, and  the  optimal  number  of  blank  frames  allowed  to  pass  before  re- 
moving the  extra  slots  are   parameters  that  can  be  determined  from  simulation 
studies  of  the  loop  network. 


2.3  Security  and  Delivery  Failure 

The  network  design  should  insure  that  messages  are  received  only 
by  the  terminals  to  which  they  are  addressed.  Some  messages  are  bound  to 
be  undeliverable  due  to  various  reasons  such  as  errors  in  the  destination 
address  field,  the  addressed  receiver  not  operating,  or  some  other  reason. 
There  should  be  some  mechanism  in  the  network  to  recognize,  purge,  and  re- 
transmit these  messages.  If  a  source  address  field  is  available,  they 
might  be  returned  to  the  sender.  Otherwise,  a  handshaking  procedure  could 
be  used  to  detect  the  loss  of  messages.  Most  loop  networks  have  a  special 
type  of  node  that  attends  this  problem.2'6 

2.4  Damage  Recovery 

To  achieve  fault  tolerance,  most  communication  networks  utilize 
the  data  processing  capabilities  available  in  their  stations  to  detect  and 
locate  damage.2'3*1*'6  The  software  then  takes  any  action  available  to  it 
to  correct  the  fault  or  to  minimize  its  affect.  The  difference  between 
fault  tolerance  and  damage  tolerance  is  intent.  Civilian  systems  need  only 
be  fault  tolerant,  but  military  systems  must  be  damage  tolerant.  They 
must  still  operate  with  minimum  degradation  when  any  portions  have  been 
deliberately  destroyed.  The  requirement  that  a  communication  network 
still  operate  with  any  part  missing,  implies  completely  distributed  control 
No  parts  must  be  critical  to  the  functioning  of  the  system. 

When  health  assessment  is  done  by  software,  sophisticated  tech- 
niques can  be  used.  The  ARPA  network,  a  packet  switched,  store  and  forward 


system,  uses  Interface  Message  Processors  (IMPs)  as  stations.1*  Each  IMP 
is  connected  to  one  or  more  host  computers.  Each  packet  sent  between  any 
two  IMPs  must  be  acknowledged  by  the  receiver.  In  the  absence  of  message 
packets,  the  IMP  programs  transmit  idle  packets  at  half  second  intervals. 
A  dead  line  is  defined  as  the  sustained  absence  of  either  normal  message 
packets  or  idle  packets.  When  dead  lines  are  detected,  packets  are  re- 
routed. Disconnected  IMPs  (two  IMPs  isolated  from  each  other  by  dead  lines) 
are  detected  by  using  a  variation  of  the  IMPs'  dynamic  routing  algorithm. 
IMPs  detect  dead  Host  computers  in  several  ways,  each  involving  lack  of 
response  to  specific  stimuli. 

When  data  processors  are  not  available  in  stations,  less  sophis- 
ticated techniques  must  be  used  for  determining  if  terminals  or  transmission 
lines  are  currently  intact.  The  inputs  and  outputs  of  the  stations  can  be 
examined  for  correct  characteristics.  The  methods  used  and  characteristics 
examined  should  be  coarse  enough  to  allow  noise  to  momentarily  disrupt  the 
flow  of  data,  but  sensitive  enough  to  detect  damaged  circuits  and  broken 
transmission  lines.  Some  form  of  time  averaging  can  be  used  to  accomplish 
this. 

The  reliability  of  loop  networks  can  be  increased  by  providing  a 
standby  loop  that  parallels  the  main  loop.  There  are  three  ways  the  standby 
loop  can  be  used.  The  first  way  is  the  bypass  technique  and  is  shown  in 
Figure  2a.  In  loops  using  the  bypass  technique,  traffic  can  be  rerouted 
around  any  number  of  malfunctioning  stations,  thus  maintaining  the  con- 
nectivity of  the  loop.  The  technique  fails  completely,  though,  when  a 
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reconfiguration  unit  fails.  The  second  technique  is  the  isolating  or 
self-heal  connection  shown  in  Figure  2b.  By  using  the  self-heal  technique 
complete  connectivity  can  be  maintained  when  any  number  of  adjacent  termi- 
nals or  reconfiguration  units  fail.  When  two  nonadjacent  nodes  or  recon- 
figuration units  fail,  the  sections  of  the  loop  on  either  side  of  the 
failure  are   isolated.  The  third  technique  is  the  combination  of  the  first 
two.  Here,  the  bypass  technique  is  used  when  terminals  fail,  and  the  self- 
heal  technique  is  used  when  reconfiguration  units  fail.  When  using  this 
combination,  sections  of  the  loop  are  isolated  only  when  nonadjacent  recon- 
figuration units  fail.  Zafiropulo8  analyzed  the  reliability  of  these 
techniques  and  concluded  that  for  loop  networks  having  approximately  20 
to  40  terminals,  the  combined  and  self-heal  connections  are  much  more  reli- 
able than  the  bypass  connection  (due  to  reconfiguration  unit  failure).  The 
combined  technique  was  found  to  be  only  slightly  better  than  the  self-heal 
method.  When  the  number  of  stations  increase,  the  performance  of  the  self- 
heal  technique  degrades  and  eventually  falls  below  that  of  the  bypass  tech- 
nique. This  is  because  the  failure  probabilities  he  used  were  small  enough 
so  that  the  probability  of  multiple  terminal  failures  was  much  less  than 
that  of  single  failures.  When  the  number  of  terminals  rises,  the  proba- 
bility of  multiple  failures  increases  causing  the  bypass  technique  to  look 
better. 

When  considering  damage  tolerance,  the  connectivity  of  a  network 
must  be  examined  when  increasing  numbers  of  parts  are  assumed  destroyed. 
The  bypass  technique  is  not  suitable  because  it  cannot  handle  damaged 
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reconfiguration  units.  The  self-heal  technique  was  chosen  for  use  in  the 
ARC  system.  The  combined  technique  would  be  only  a  little  better  due  to 
the  fact  that  the  probability  of  a  reconfiguration  unit  being  hit  is  ap- 
proximately the  same  as  that  of  a  station. 
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3  SYSTEM  DESCRIPTION 

In  this  section  the  design  decisions  and  actual  implementation 
of  the  ARC  system  are  discussed. 

3.1  General  Operation 

The  ARC  system  is  a  double  loop  network  with  distributed  control. 
The  information  channel  in  the  network  is  synchronous  and  time  division 
multiplexed  with  addressed  blocks.  Information  is  conveyed  around  the  loop 
in  frames,  passing  through  each  station  once  during  each  circumnavigation; 
hence  the  name  "Addressable  Ring  Conveyor."  Each  of  the  stations  behave 
like  shift  registers  with  one  storage  cell  for  each  bit  position.  The 
number  of  frames  circulating  is  equal  to  the  number  of  stations  on  the  loop 
There  are  no  bit  positions  in  the  loop  that  are  not  part  of  a  frame.  The 
transmission  clock  rate  is  1MHz. 

3.1.1  Frame  Structure 

Since  the  network  is  designed  to  connect  transducers,  actuators, 
and  displays  to  controlling  devices,  the  messages  to  be  transmitted  over 
the  network  are  \/ery   short.  A  sixteen  bit  frame  format  was  chosen  and  is 
shown  in  Figure  3.  Bipolar  modulation  is  used.  It  allows  two  bits  of  in- 
formation to  be  transmitted  each  clock  period—one  bit  above  the  reference 
voltage  (ground)  during  the  first  half  of  the  clock  period,  and  one  bit 
below  the  reference  during  the  second  half  of  the  clock  period.  Two  serial 
data  streams  are  combined  into  bipolar  form  for  transmission  and  separated 
upon  receipt  with  simple  synchronous  circuitry.  See  Figure  4. 
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Figure  4a.     Bipolar  Modulator/ Demodulators 


Figure  4b.     Photograph  of  Bipolar  Signal 
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The  positive  pulses  of  the  frame  carry  the  information  to  be 
transmitted.  They  are  arbitrarily  divided  into  a  ten-bit  Data  field  and 
a  seven-bit  Instruction  field.  The  negative  going  pulses  contain  a  seven- 
bit  Monitor  field  which  must  always  be  present.  Its  presence  is  used  for 
frame  synchronization  and  health  assessment.  The  negative  pulses  also 
hold  the  destination  address.  A  '0000000'  address  denotes  a  "null"  or 
empty  frame.  The  address  '1111111'  is  not  allowed  because  it  is  indis- 
tinguishable from  the  monitor  field.  There  are  126  valid  addresses.  Bi- 
polar modulation  allows  the  network  supervisory  bits  to  be  transmitted 
during  the  same  clock  periods  as  the  data. 

3.1.2  Control  Sequence 

A  control  sequence  might  occur  as  follows:  A  controller  sends  a 
frame  to  a  transducer  with  the  controller's  address  in  field  D  and  an  in- 
struction in  field  I  calling  for  the  transducer  to  transmit  its  output. 
The  transducer  will  send  a  frame  to  the  address  supplied  by  the  controller 
with  its  output  in  field  D  and  a  code  in  field  I  that  identifies  itself 
as  the  source  of  the  data.  The  controller  might  then  send  the  value  to  a 
control  panel  for  display. 

To  write  data  on  to  the  loop,  a  station  watches  passing  frames. 
When  a  null  frame  arrives,  the  destination  address  and  information  bits  are 
loaded  asynchronously  and  in  parallel  into  the  frame.  To  read  data  from 
the  loop,  a  station  recognizes  its  own  address,  gates  the  informations  in 
positive  half  of  the  frame  into  a  buffer  register,  clears  the  address  and 
information  fields,  then  signals  its  device  that  data  is  available. 
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3.1.3  Damage  Tolerance 

By  looking  continuously  at  the  monitor  bit  as  they  enter  and 
leave  each  station,  a  crude  judgment  can  be  made  about  the  health  of  the 
station  and  the  section  of  transmission  line  upstream  from  it.  If  more 
than  two  of  the  seven  monitor  bits  are  missing,  the  section  of  the  loop 
(a  station  or  transmission  line)  upstream  from  the  point  where  the  condition 
was  detected  is  assumed  to  be  damaged.  The  two  out  of  seven  criterion 
provides  a  degree  of  noise  immunity  in  the  damage  detection  technique. 
A  pair  of  reed  relays  form  the  reconfiguration  unitswhich  are  called  com- 
mutators. In  this  implementation  there  is  a  dedicated  commutator  on  both 
sides  of  each  station  as  shown  in  Figure  5.  If  the  stations  are  to  be 
physically  closer  together,  they  might  share  control  of  one  commutator 
between  them.  When  damage  is  detected,  the  commutator  controlled  by  the 
Commutator  Control  Circuit  that  detected  the  fault,  and  the  commutator 
upstream  from  it  are  released.  This  action  isolates  the  damaged  section 
by  routing  data  through  the  emergency  loop  to  the  following  station.  Com- 
mutators are  assumed  to  be  healthy  if  the  signal  tapped  at  the  relay  coil 
is  the  same  as  that  driven  at  the  output  of  the  Commutator  Control  Circuit. 
If- they  are   not  the  same,  the  two  commutators  on  either  side  are  released 
and  the  faulty  commutator  is  isolated. 

If  the  station  or  section  of  transmission  line  immediately  up- 
stream from  a  station  fails,  the  invalid  frame  upon  which  the  judgment  was 
made  will  already  have  been  passed  on.  Because  the  commutators  use  reed 
relays,  which  are  mechanical  devices  much  slower  than  the  network  clock 
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rate,  several  more  frames  will  be  lost  before  the  switching  is  completed. 
Assuming  a  lOOys  release  time,  1  frame  +  flOOus  /  16us/frame]  =  8  invalid 
frames  are   shifted  into  the  station  downstream  from  the  damaged  section  be- 
fore the  commutators  can  finish  switching.  Provision  is  made  in  the  Com- 
mutator Control  and  the  Lower  Shift  Register  circuits  to  load  and  transmit 
valid  frames  whenever  invalid  frames  are  received.  This  includes  frames 
that  are  corrupted  by  noise. 

Each  ARC  station  contains  three  printed  circuit  cards  with  a  total 
of  36  TTL  integrated  circuit  packages.  Associated  with  each  station  are 
the  two  Commutator  Control  cards.  These  have  11  integrated  circuit  packages 
each.  Also  included  with  each  station  is  an  Interface  and  Panel  Driver 
board.  A  device  may  use  the  station  to  access  the  loop,  or  data  may  be 
entered  manually  via  the  front  panel  controls. 

The  ARC  system  implementation  is  a  prototype  and  a  demonstration 
model.  Some  of  the  problems  associated  with  "real  world"  systems  are  not 
considered.  The  clocks  in  each  station  must  be  synchronized  with  all  the 
others.  Therefore,  a  common  clock  is  provided.  Also,  there  is  no  provision 
for  purging  undeliverable  frames.  Because  damage  tolerance,  and  therefore, 
distributed  control  is  required,  a  loop  control  module  is  not  provided. 
This  problem  could  be  handled  within  the  realm  of  distributed  control  and 
modularity  by  making  the  stations  used  by  the  controlling  devices  more 
sophisticated.  A  microprocessor  in  these  stations  could  handle  most  loop 
supervisory  functions.  If  all  of  the  control  devices  are   damaged,  there 
would  no  longer  be  any  need  for  the  network,  so  their  supervisory  functions 
would  not  be  missed. 
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3.2  The  Stations 

3.2.1  The  Lower  Shift  Register  (LSR) 

The  function  of  the  Lower  Shift  Register  is  to  examine  and  modify 
the  address  field  and  to  reload  the  monitor  bits  if  necessary.  Since  the 
data  signals  the  LSR  operates  on  are  between  OV.  and  -5V.,  the  integrated 
circuits  are  powered  with  Vcc  =  OV.  and  GND  =  -5V.  The  LSR  provides  two 
control  signals  for  the  station  control  card.  When  the  address  field  is 
determined  to  contain  all  zeros,  the  WRITE  ENABLE  signal  is  lowered  for 
the  duration  of  the  condition.  Likewise,  when  the  station's  own  address 
is  found,  the  READ  ENABLE  signal  lowered.  See  Figure  6. 

A  destination  address  can  be  accepted  from  either  the  panel  or  an 
external  device.  It  is  stored  in  a  buffer  until  a  write  operation  can  be 
done.  To  write,  the  shift  register  is  loaded  asynchronously  with  WRT"  active 
For  a  read  operation  or  when  'fixing'  an  invalid  frame,  the  LSR  does  an 
asynchronous  load  in  the  absence  of  the  WRT~  signal.  This  loads  and  empty 
frame . 

The  first  step  in  modulating  the  output  data  stream  is  done  on 
this  card.  The  active  LOW  data  signal  from  the  shift  register  is  ORed  with 
the  clock  waveform.  The  product  is  HIGH  when  the  data  signal  is  inactive 
and  LOW  only  during  the  second  half  of  the  clock  period  when  the  data 
signal  is  active. 

3.2.2  The  Upper  Shift  Register  (USR) 

The  information  sent  is  carried  in  the  upper  part  of  the  frame. 
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Buffers  are  provided  for  incoming  and  outgoing  data.  The  16-bit  field  can 
be  split  up  into  fields  or  used  in  any  way  desired.  The  USR  logic  is  shown 
in  Figure  7. 

3.2.3  The  Station  Control  (SC) 

The  Station  Control  accepts  Read  Requests  and  Write  Requests  from 
an  external  device  or  the  front  panel  then  executes  them  as  soon  as  loop 
traffic  permits.  During  a  read,  the  upper  shift  register  as  well  as  the 
address  field  is  cleared,  even  though  it  is  not  necessary.  Level  shifting 
is  done  with  two  open  collector  buffers.  The  bipolar  signal  is  modulated 
from  TTL  open  collector  outputs  and  only  one  discrete  transistor.  Figure 
8  shows  the  Station  Control  logic  and  Figure  4  shows  the  complete  modulation/ 
demodulation  scheme  and  a  photograph  of  a  bipolar  signal. 

3.2.4  Interfacing  to  Stations 

The  ARC  station—device  interface  is  a  simple  handshaking  proce- 
dure. A  device  can  enable  or  inhibit  reading  by  the  station  with  the  Read 
Request  input  signal.  When  the  station  does  read  a  word  from  the  loop,  it 
pulses  its  Read  Acknowledge  line.  It  is  the  responsibility  of  the  device 
to  accept  the  data  before  Read  Acknowledge  pulses  again.  There  are  at  least 
16ysec  between  consecutive  reads.  When  the  device  wishes  to  write  on  to 
the  loop  it  puts  the  destination  address  on  the  address  lines  then  pulses 
DADRIN.  The  device  also  puts  data  on  the  information  lines  then  pulses 
INFOIN.  These  two  actions  may  be  done  in  any  order  or  at  the  same  time. 
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Then  the  device  pulses  the  WRT  REQ  line  and  waits  for  the  station  to  ac- 
knowledge that  the  data  has  been  sent  with  a  pulse  on  the  Write  Acknowledge 
line.  This  same  procedure  can  be  executed  from  the  front  panel.  The  read 
and  write  acknowledge  signals  are  brought  out  to  LEDs  on  the  front  panel 
which  are  sent  a  pulse  that  is  long  enough  to  see.  If  a  station  is  waiting 
to  serve  a  write  request  and  a  frame  arrives  addressed  to  it,  the  station 
will  accept  the  data  in  the  frame  then  immediately  write  into  the  same 
frame. 

3.3  The  Commutator  Controllers  (CC) 

3.3.1  The  Commutators 

It  is  a  requirement  that  the  commutators  assume  the  isolate  posi- 
tion if  power  to  them  is  lost.  For  this  reason,  a  solid  state  device  could 
not  be  used.  A  survey  of  currently  available  reed  relays  was  made  to  find 
the  fastest  relays  that  are   compatible  with  TTL  logic.  Clare  No.  922A05C2C 
relays  were  chosen.  They  will  operate  with  a  driving  current  of  25mA.  at 
4V.  The  rated  operate  and  release  times  are  500us  and  250ys.  A  sample  of 
three  were  tested  for  actual  operating  speeds.  The  operate  times  varied  be- 
tween 250ys  and  350ys.  The  release  times  (the  critical  parameter)  were  be- 
tween 40ys  and  60ys.  This  is  five  times  the  rated  speed.  The  configuration 
used  is  DPDT  or  2C2.  A  diagram  and  photograph  of  a  commutator  are  shown  in 
Figure  9. 

3.3.2  The  Controllers 

The  Commutator  Control  circuits  serve  a  three-fold  purpose.  They 
monitor  the  health  of  the  network  segment  upstream  from  them,  they  provide 
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frame  synchronization  for  the  stations,  and  they  signal  the  associated 
station  when  it  must  replace  a  corrupted  frame.  The  synchronization  capa- 
bility of  the  CC  circuit  that  is  immediately  downstream  from  a  station  is 
not  used  but  was  included  to  maintain  modularity.  CC  circuits  are   inter- 
changeable regardless  of  their  position  with  respect  to  the  stations. 

One  CC  circuit  testing  the  output  of  each  station  might  have 
been  used  to  control  both  commutators  adjacent  to  that  station.  This 
arrangements,  however,  would  not  protect  against  breaks  in  the  transmission 
lines  between  sections.  A  second  circuit  testing  data  entering  a  station 
can  detect  severed  lines.  Since  corrective  action  always  involves  the 
release  of  two  commutators,  there  must  be  a  connection  between  each  CC 
circuit  and  the  CC  circuit  upstream. 

If  a  commutator  controller  detects  a  commutator  failure,  the 
adjacent  upstream  and  downstream  commutators  must  be  released.  This  neces- 
sitates a  connection  between  each  CC  circuit  and  the  next  one  downstream. 
These  two  connecting  signals  are   active  Low,  so  that  if  a  station  is  de- 
stroyed and/or  the  connections  are  severed,  the  receiving  CC  circuit  will 
interpret  the  floating  signal  as  an  order  to  release  its  commutator.  See 
Figure  10. 

In  each  controller  is  a  latch  that  indicates  whether  the  section 
of  the  loop  upstream  from  a  CC  circuit  is  intact  or  not.  The  latch  is 
updated  eyery   frame  time  (16ys).  The  criterion  for  setting  the  latch  is 
that  no  more  than  two  adjacent  bits  of  the  seven  monitor  pulses  are  missing. 
This  is  determined  by  a  capacitive  integration  of  the  monitor  field.  The 
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complimentary  output  of  the  latch  is  ORed  with  the  signals  from  the  adjacent 
commutators  and  this  result  is  again  latched  to  assure  that  once  the  con- 
trolled commutator  is  released,  the  corrected  condition  will  not  set  it 
again.  This  is  shown  in  Figure  11. 

The  adjacent  downstream  commutator  is  instructed  to  release  only 
if  the  controlled  commutator  is  directed  to  operate,  but  is  determined  to 
be  released  (the  criterion  for  defining  a  damaged  commutator).  The  adja- 
cent upstream  commutator  is  asked  to  release  if  the  above  condition  exists 
or  if  the  health  indicator  latch  contains  a  zero. 

The  frame  synchronization  and  mangled  frame  replacement  functions 
are  implemented  with  one  NAND  gate  that  checks  if  all  of  the  address  bits 
are  not  active  (LOW)  and  one  NAND  gate  that  checks  if  all  of  the  monitor 
bits  are  active.  When  these  conditions  are  true,  a  valid  frame  exists  in 
the  examination  register  and  in  the  next  station.  If  a  valid  frame  doesn't 
appear  every  16  clock  cycles,  the  timing  register  is  not  cleared.  If  not 
cleared,  the  timing  reigster  sends  a  pulse  every  16  clock  cycles  to  the 
station,  directing  it  to  load  a  valid  frame.  Thus,  each  healthy  station 
transmits  a  valid  frame  e\/ery   16  clock  periods  regardless  of  the  signal  it 
receives. 

A  reset  pulse  received  either  from  the  common  reset  pushbutton 
or  the  panel  pushbutton  will  preset  the  two  latches  and  clear  the  examina- 
tion register.  This  opens  the  commutators  and  initializes  the  commutator 
control  circuits. 
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4  CONCLUSIONS 

The  ARC  system  implementation  demonstrates  the  feasibility  and 
damage  tolerance  of  the  double  loop  topology.  The  system  can  survive  any 
one  group  of  adjacent  hits  and  maintain  complete  connectivity  among  the 
remaining  nodes.  Several  more  hits  can  be  survived  if  they  occur  in  non- 
critical  areas  (i.e.,  the  standby  loop  where  it's  not  being  used  or  the 
connections  between  CC  circuits  that  are  already  released).  Bipolar  modu- 
lation is  shown  to  be  an  effective  means  of  doubling  the  transmission  rate 
without  overly  increasing  circuit  complexity. 

The  Station  Control  and  Interface  /  Panel  Driver  circuits  could 
have  been  less  complex  had  the  Lower  Shift  Register  and  the  Commutator  Con- 
trol integrated  circuit  chips  been  powered  normally.  This  way  the  number 
of  level  converters  in  a  station  would  be  reduced  to  two--one  just  before 
the  bipolar  modulator  and  one  just  after  the  demodulator. 

A  technique  was  suggested  that  would  allow  survival 
of  any  two  groups  of  nonadjacent  hits.  This  is  achieved  by  the  addition 
of  two  complex  switching  points,  more  sophisticated  detection  logic  and 
four  connections  between  each  station  and  the  switching  points.  Though 
this  technique  can  survive  one  more  group  of  adjacent  hits,  it  adds  two 
more  switching  modules  and  greatly  increases  the  total  wire  length. 
It  is  possible  to  generalize  the  automatic  reconfiguration  to  an  arbi- 
trary number  of  hits. 

For  actual  use  on  board  a  ship,  the  ARC  system  would  need  sev- 
eral enhancements.  Providing  a  common  clock  to  each  station  introduces 
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serious  complications  so  a  method  is  needed  to  synchronize  the  stations' 
clocks  to  the  incoming  data.  An  inexpensive  microprocessor  should  be  in- 
corporated in  the  stations  that  serve  controllers,,  They  would  keep  the 
loop  properly  formatted  and  perform  all  necessary  supervisory  functions. 
The  supervisory  stations  that  exist  higher  in  the  hierarchy  of  loop  net- 
works would  be  increasingly  more  sophisticated  than  those  at  low  levels. 
The  combined  bypass  and  self-heal  connection  could  be  used  to  partially 
increase  survivability.  With  these  modifications,  an  ARC  like  system 
could  be  used  advantageously  for  shipboard  communication. 
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